d:\cm\build\public\ee_m14r2_25092006\csi\projects\ee\dist_staging\Release\Cod\hostmanager\AOLHostMgr.pdb
Static task
static1
Behavioral task
behavioral1
Sample
09599efdabe55042905cbf0540a0e28d_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
09599efdabe55042905cbf0540a0e28d_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
09599efdabe55042905cbf0540a0e28d_JaffaCakes118
-
Size
124KB
-
MD5
09599efdabe55042905cbf0540a0e28d
-
SHA1
831d6596bbf8e78a8c4c2fa3381560985b7a1318
-
SHA256
62576667e5d54ddc6428e182a5dfb92b3e1596c43b10eae4e11c66cd69b6b7b4
-
SHA512
0f5395e3e4a861d6555c6442193dcbdaa24ce40c1fddf7e0207e06483fe2816801858faae11f70158e4fa5c9ad606fe4e5a1cfd4159c1ea9a3ac24164bc5f690
-
SSDEEP
3072:MYClhrGEN4ucaZa6EDjD4eNcxAZOwpIXrai:cyaEb4eNcmvMN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 09599efdabe55042905cbf0540a0e28d_JaffaCakes118
Files
-
09599efdabe55042905cbf0540a0e28d_JaffaCakes118.dll windows:4 windows x86 arch:x86
1cb10e06ca2dbca681e331402117653a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
FreeLibrary
CompareStringA
InterlockedExchange
GetModuleHandleA
GetModuleFileNameA
CloseHandle
GetSystemDirectoryA
LoadLibraryA
GetLastError
SetLastError
GetWindowsDirectoryA
ExitProcess
VirtualQuery
GetCurrentProcess
GetProcessWorkingSetSize
SetProcessWorkingSetSize
UnmapViewOfFile
MapViewOfFile
GetCurrentThreadId
InterlockedCompareExchange
ResetEvent
SetEvent
user32
SetTimer
KillTimer
WaitForInputIdle
MsgWaitForMultipleObjects
TranslateMessage
DestroyWindow
OpenDesktopW
EnumDesktopWindows
ole32
CoInitialize
CoCreateInstance
CreateBindCtx
CoTaskMemFree
StringFromCLSID
CoRegisterMessageFilter
CoInitializeEx
CoUnmarshalInterface
CreateStreamOnHGlobal
CoMarshalInterface
CoUninitialize
oleaut32
VariantChangeTypeEx
SafeArrayRedim
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayCopy
SafeArrayDestroy
VariantClear
VariantCopy
SysAllocString
VariantInit
SafeArrayLock
SafeArrayCreate
SafeArrayUnlock
xprt5
xprt_strlcpy
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
xprt_strcmp
xprt_memmove
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?Find@TBstr@XPRT@@QBEHGH@Z
?GetLength@TBstr@XPRT@@QBEHXZ
??1TBstr@XPRT@@QAE@XZ
?GetAt@TBstr@XPRT@@QBEGH@Z
?Add@TPtrArray@XPRT@@QAEHPAX@Z
xprt_ucslcpy
_XprtStringLen@4
?TestAccess@TFile@XPRT@@SA_NPBGI@Z
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
??0TMessageDigest@XPRT@@QAE@XZ
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
?Append@TBstr@XPRT@@QAEAAV12@G@Z
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
xprt_memcpy
xprt_strlen
?Unlock@TSpinLock@XPRT@@QAEXXZ
XprtTrace
?Lock@TSpinLock@XPRT@@QAEXXZ
??0TPtrArray@XPRT@@QAE@XZ
??1TPtrArray@XPRT@@QAE@XZ
?Left@TBstr@XPRT@@QBE?AV12@H@Z
?Empty@TBstr@XPRT@@QAEXXZ
??0TBstr@XPRT@@QAE@GH@Z
?TrimRight@TBstr@XPRT@@QAEAAV12@XZ
?TrimLeft@TBstr@XPRT@@QAEAAV12@XZ
?Append@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
?FreeDataChain@SPlex@XPRT@@QAEXXZ
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
?Lock@TCritSec@XPRT@@QAEXXZ
?Unlock@TCritSec@XPRT@@QAEXXZ
?Init@TCritSec@XPRT@@QAEXXZ
_XprtMemAlloc@4
_XprtGetSystemInfo@0
XprtTrace2
_XprtBinToBase64@16
kSystemEncoding
?Append@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
??0TBstr@XPRT@@QAE@PBDPBG@Z
?Compare@TBstr@XPRT@@QBEHPBG@Z
_XprtPostQuitMessage@8
??0TBstr@XPRT@@QAE@PBG@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
_XprtMemFree@4
?DirSpecFromFullSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?AppendFileNameToSpec@TFile@XPRT@@SA?AVTBstr@2@PBG0@Z
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
_XprtHashString@4
_XprtCompareString@8
_XprtFreeString@4
_XprtAllocString@4
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
??1TPtrFromPtrMap@XPRT@@QAE@XZ
??0TBstr@XPRT@@QAE@ABV01@@Z
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
_XprtCreateThread@8
_XprtInitialize@8
_XprtUninitialize@0
_XprtDestroyThread@8
_XprtAtomicDecrement@4
_XprtAtomicIncrement@4
?Sleep@TThread@XPRT@@SAXI@Z
?Term@TCritSec@XPRT@@QAEXXZ
xprt_memset
?Format@TBstr@XPRT@@QAAXPBGZZ
_XprtGetMilliseconds@0
?IsEmpty@TBstr@XPRT@@QBE_NXZ
_XprtGetMessageQueue@0
_XprtMessageLoop@0
?Detach@TBstr@XPRT@@QAEPAGXZ
??0TBstr@XPRT@@QAE@XZ
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?Attach@TBstr@XPRT@@QAEXPAG@Z
xprt_iswdigit
msvcrt
_adjust_fdiv
malloc
_initterm
free
_onexit
__dllonexit
_vsnprintf
_getpid
memset
_except_handler3
_purecall
qsort
strcmp
setlocale
_snwprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
_wcslwr
advapi32
RegCloseKey
Exports
Exports
Shutdown
StartHostManagerThread
StopHostManagerThread
gSMEnableTracingPtr
Sections
.text Size: 68KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.eeSMCac Size: 4KB - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 136KB - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE